Telegram Desktop Bug Deletes 800 GB of User Data Due to Spelling Checker Path Error
A Windows user reported losing nearly 800 GB of data after updating Telegram Desktop. Files began disappearing from the custom directory C:\custom immediately after launching the messenger, while folders themselves remained intact.
Tracing the culprit
By monitoring application launches, the user isolated the issue to Telegram Desktop. Reinstalling the application to a separate location and creating test files confirmed that Telegram continued to target the original folder. Testing across versions showed the problem appeared after updating from 6.9.4 to 7.1.1.
Process Monitor investigation
Running Process Monitor revealed that Telegram.exe opened C:\custom, enumerated its contents, requested delete permissions, and attempted recursive removal. Stack traces pointed directly inside the Telegram binary, ruling out malware.
Root cause in spell checking
The deletion originated from the lib_spellcheck library. Telegram stores user-added words in a file named custom. In version 7.1.0, changes to support Windows native spell checking introduced a logic error: the path to the internal dictionary was set after an early return when the system spell checker was active.
With an empty working directory path, the code constructed the string /custom. Qt resolved this to C:\custom on the root of the current drive. The subsequent check if (QFileInfo(path).isDir()) { QDir(path).removeRecursively(); } then deleted the entire folder instead of a small internal dictionary directory.
Fix and impact
Developers corrected the issue in commit 9c316281 by setting the path before the return and added an empty-path guard in lib_spellcheck. The faulty versions remained available for roughly 66 hours. The bug was confirmed only on Windows with native spell checking enabled.
The case demonstrates how individually reasonable decisions—storing custom words, cleaning damaged directories, and using recursive deletion—combined into severe data loss when path validation was absent.
Related articles
Stored XSS in Telegram Desktop Allows Silent Data Exfiltration via Chat Export
Researchers at ExPatch Vulnerability Research discovered a stored XSS vulnerability in Telegram Desktop that could be triggered when users exported chat history to HTML. The flaw resided in export_output_html.cpp where button text from inline keyboards was not passed through the SerializeString function, allowing arbitrary HTML and JavaScript to execute upon opening the exported file. Attackers could deliver the payload through a bot that never joined the target group, relying on message forwarding to reach victims. Once executed, the script exfiltrated all visible messages, chat metadata, and file paths to an attacker-controlled server while optionally replacing the page with a phishing form. Telegram issued a silent fix in Beta v6.9.4 and Stable v7.0.1 without publishing an advisory or assigning a CVE. The researchers refused the offered bounty and published the details after the patch to inform users about risks from previously exported files.
Cisco Confirms Active Exploitation of Critical Secure Email Gateway Flaw Allowing Root Command Execution
Cisco has confirmed active exploitation of a critical vulnerability in its Secure Email Gateway product that allows attackers to execute arbitrary commands with root privileges. The flaw, tracked as CVE-2026-76461 with a CVSS score of 9.8, stems from insufficient input validation in the message analysis logic of AsyncOS. Attackers can trigger the issue by sending a specially crafted email containing malicious SQL instructions, which leads to arbitrary SQL command execution and full root access on affected appliances. The vulnerability impacts physical and virtual deployments running AsyncOS versions 15.5 and earlier, 16.0, and 16.5. Patches are available in versions 15.5.5-0141, 16.0.4-302, and 16.5.0-780, while the Secure Email and Web Manager and Secure Web Appliance remain unaffected. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 14 and set a September 17 remediation deadline for federal agencies.
Cisco ISE Affected by 42 Vulnerabilities Including Multiple Critical Flaws with Confirmed Exploitation
Cisco Identity Services Engine (ISE) has been found to contain 42 vulnerabilities across 15 security advisories released by Cisco Systems on September 16, 2026. Six advisories received the highest Critical rating, covering 21 individual vulnerabilities, while three were rated High and six Medium. One standout issue, CVE-2026-76460, allows attackers to bypass authentication on the management API via crafted HTTP requests and execute commands with root privileges. The flaw also impacts the Cisco ISE Passive Identity Connector (ISE-PIC). Cisco has urged immediate application of updates as some vulnerabilities are already being exploited in the wild. The product provides core network authentication and access control functions for enterprise environments.
CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog, Including Cisco ISE and Acronis Backup Flaws
The US Cybersecurity and Infrastructure Security Agency has added three vulnerabilities with confirmed in-the-wild exploitation to its Known Exploited Vulnerabilities catalog. The flaws affect Cisco Identity Services Engine, its Passive Identity Connector, and Acronis Backup plugins for cPanel and Plesk. All three entries carry a remediation deadline of September 19, 2026. The Cisco issue stems from insufficient authentication controls on an API endpoint that lets remote attackers bypass the web-based management interface. The Acronis vulnerability arises from overly permissive default settings in server-management plugins, enabling privilege escalation. Federal agencies have been directed to investigate potential compromises and apply mitigations without delay.